PyPI/apache-airflow CVE-2026-31987: high 7.5, EPSS 0.74%

Apache Airflow: JWT token appearing in logs

Action: Upgrade apache-airflow to 3.2.0 or later.

pip install apache-airflow==3.2.0

Affected

Fixed versions

Sources

• osv: GHSA-phv5-vq5p-qhp7
• https://nvd.nist.gov/vuln/detail/CVE-2026-31987
• https://github.com/apache/airflow/issues/62428
• https://github.com/apache/airflow/issues/62773
• https://github.com/apache/airflow/pull/62964
• https://github.com/apache/airflow
• https://lists.apache.org/thread/pvsrtxzwo9xy6xgknmwslv4zrw70kt6g
• http://www.openwall.com/lists/oss-security/2026/04/16/7

CVE-2026-31987 · published 2026-04-16T15:31:32Z · modified 2026-07-13T16:42:46.916265698Z · JSON